Abstract:Many modern processors have embedded hardware tracing techniques (e.g., Intel Processor Trace or ARM CoreSight). While these techniques are widely used due to their transparency and low overhead, they also bring serious security threats. Attackers can utilize hardware tracing to trace the trusted applications from a non-secure application. Existing protection techniques fail to effectively protect the runtime information when hardware tracing is employed. To counter these threats, in this paper, we propose a novel direction called anti-hardware tracing. Our key idea is to exploit the limitations of hardware tracing: trace buffer overflow can cause trace data loss. We build a model to analyse the overflow and outline three principles for efficient triggering overflows and achieving anti-hardware tracing: numerous branches in the program, high-speed execution of the program, and the high-water mark of the trace buffer. We develop a framework called Armor on ARM Juno R2 to realize our approach. Armor protects software against the trace unit Embedded Trace Macrocell (ETM) in CoreSight by instrumenting protection and loop functions. The protection function detects runtime environments, efficiently fills the trace buffer, and employs various protection strategies like PID (process identifier) replacement and PIE+STRIP+ASLR. Meanwhile, the loop function triggers overflows efficiently based on context-based calculations and anti-ETM loop. Our evaluation demonstrates that the overhead of Armor is 77.31% lower than that of OLLVM [1] on SPEC2006. Armor effectively hides 54.51% of basic blocks across 16 real-world applications, triggering 113× more overflows. Moreover, we showcase two practical applications of Armor. Firstly, we conduct a cryptographic and cross-world attack on GnuPG 1.4.13 RSA private keys using ETM, which can steal entire keys from a program in the Secure world with a single run. Armor successfully reduces leaked bits by 84.5%. Secondly, Armor impedes hardware-assisted fuzzing by reducing throughput by 89.71% and branch coverage by 47.99%.

A Practical Method to Confine Sensitive API Invocations on Commodity Hardware.

Hardware-Assisted Control-Flow Integrity Enhancement for IoT Devices

Adaptive Call-Site Sensitive Control Flow Integrity

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Method to Efficiently Protect Applications from Untrusted OS Kernel

Dynamic Tracking Reinforcement Based on Simplified Control Flow

HCIC: Hardware-assisted Control-flow Integrity Checking

A Native APIs Protection Mechanism in the Kernel Mode Against Malicious Code

Practical Control Flow Integrity and Randomization for Binary Executables

AppGuard: A Hardware Virtualization Based Approach on Protecting User Applications from Untrusted Commodity Operating System

Hardware-Assisted Fine-Grained Code-Reuse Attack Detection.

KEcruiser: A Novel Control Flow Protection for Kernel Extensions

Efficient And Practical Control Flow Monitoring For Program Security

ARM Pointer Authentication based Forward-Edge and Backward-Edge Control Flow Integrity for Kernels

A Method to Defend Intrusion from Hypercall of Xen

Control Flow Obfuscation with Information Flow Tracking

A Practical Online Approach to Protecting Kernel Heap Buffers in Kernel Modules

Integrating Offline Analysis and Online Protection to Defeat Buffer Overflow Attacks.

Security protection and checking for embedded system integration against buffer overflow attacks via hardware/software

A Hardware Security-Monitoring Architecture Based on Data Integrity and Control Flow Integrity for Embedded Systems

Armor: Protecting Software Against Hardware Tracing Techniques